SCS-C02 Question 392
Select 2Your company is building a serverless application on AWS that requires storing and accessing sensitive database credentials and API keys. As part of the security design, you need to ensure these credentials are protected and managed securely. Which of the following approaches should you implement? (Select TWO.)
- A
Store the credentials in AWS Secrets Manager and configure IAM policies to allow only specific roles to access them.
- B
Embed the credentials directly in the Lambda function environment variables for easy access.
- C
Use AWS Key Management Service (KMS) to encrypt the credentials and store them in an Amazon S3 bucket with fine-grained access controls.
- D
Implement AWS Systems Manager Parameter Store with encryption enabled to securely store and retrieve credentials.
- E
Hardcode the credentials into the application code and use CodePipeline to manage and deploy the code securely.
Show answer and explanation
Correct answers: A, D
Explanation
The best practices for protecting credentials, secrets, and cryptographic key materials in AWS involve using managed services like AWS Secrets Manager or AWS Systems Manager Parameter Store. These services provide secure storage, encryption, and fine-grained access controls. Embedding secrets in environment variables or application code is discouraged due to the high risk of accidental exposure.
- A. Correct.
Correct. AWS Secrets Manager provides a secure way to store and manage secrets such as credentials and API keys. It also integrates with IAM to control access, ensuring only authorized roles can access the secrets.
- B. Incorrect.
Incorrect. Embedding credentials directly into environment variables is not recommended as it increases the risk of exposure if the environment variables are accessed or logged accidentally.
- C. Incorrect.
Correct but suboptimal. While encrypting credentials with AWS KMS and storing them in S3 with fine-grained controls is possible, it requires more manual effort and is less streamlined compared to dedicated services like Secrets Manager or Parameter Store.
- D. Correct.
Correct. AWS Systems Manager Parameter Store with encryption enabled provides a secure and managed way to store and retrieve sensitive data such as credentials. It integrates with KMS for encryption.
- E. Incorrect.
Incorrect. Hardcoding credentials into the application code is a poor security practice as it increases the risk of exposure if the code is compromised or shared accidentally, even if CodePipeline is used for deployment.